@jini-ai/user-management 0.6.11 → 0.6.15-rc.1

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.6.13
+
+### Patch Changes
+
+- 0a2b903: Share accessible eye toggles across React credential fields, including multiline question answers,
+  CLI overrides, provider keys, login, new users, password resets, and source configuration. Preserve
+  autofill protection, translated toggle names, agent handles, and secret-answer redaction. Hidden
+  source environment blocks keep names visible and stored values masked until explicitly revealed.
+
+  Chat and user-management require `@jini-ai/ui ^0.5.7` for the new `SecretInput` and `SecretTextarea`
+  exports. Release UI 0.5.7 (or adjust those peer floors to the actual release containing these exports)
+  with these consumers; older UI versions cannot satisfy their imports. Hosts supply `.jini-secret`,
+  `.jini-secret-toggle`, and `.jini-secret--multiline` visual rules.
+
+- Updated dependencies [7479159]
+- Updated dependencies [c31264d]
+- Updated dependencies [0728914]
+- Updated dependencies [6ecbdb2]
+- Updated dependencies [63bacc5]
+  - @jini-ai/core@0.6.13
+
+## 0.6.12
+
+### Patch Changes
+
+- @jini-ai/core@0.6.12
+
 ## 0.6.11
 
 ### Patch Changes

package/dist/admin/adapters/memory.js

@@ -145,9 +145,11 @@ export function createMemoryUsersApi({ workspaceId }, options = {}) {
     }
     const password = (value) => { if (!value || [...value].length > 512)
         fail('VALIDATION_ERROR', 'Password must be present and no more than 512 characters.'); };
-    /** Disabling or deleting an owner must leave another active owner behind. */
-    function keepAnotherActiveOwner(u) { if (owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
-        fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.'); }
+    /** Disabling or deleting an active owner must leave another active owner behind. */
+    function keepAnotherActiveOwner(u, _optional = {}) {
+        if (u.status === 'active' && owners.has(u.principalId) && [...users.values()].filter(v => v.status === 'active' && owners.has(v.principalId)).length <= 1)
+            fail('OWNER_REQUIRED', 'The workspace must keep at least one active owner.');
+    }
     function clamp(contents) { if (grants.includes('*'))
         return; if (!contents || contents.some(p => !grants.includes(p)))
         fail('GRANT_EXCEEDS_ISSUER', 'Grant exceeds issuer.'); }

package/dist/admin/react/components/UsersConfirmation.js

@@ -1,9 +1,12 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
-import { ConfirmDialog, TextField, Button, Notice } from '@jini-ai/ui-kit/react';
+import { ConfirmDialog, Notice } from '@jini-ai/ui-kit/react';
+import { SecretInput } from '@jini-ai/ui';
+import { useId } from 'react';
 import { useUsersConfirmation, newPasswordAttrs } from '../hooks/UsersTab.hooks.js';
 /** Kept mounted independently of row menus. Confirmation and cancellation share ui-kit's guards. */
 export function UsersConfirmation(_required = {}, _optional = {}) {
     const v = useUsersConfirmation({});
-    return _jsx(ConfirmDialog, { ...v.confirm, body: _jsxs("div", { children: [_jsx("p", { children: v.s.pending?.user.username }), _jsx("p", { children: v.copy.body }), v.reset ? _jsxs(_Fragment, { children: [_jsx(TextField, { label: "New password", type: v.newType, attrs: newPasswordAttrs, value: v.s.newPassword, onValueChange: v.newPassword, disabled: v.s.confirming }), _jsx(Button, { onPress: v.toggleNew, attrs: { 'aria-pressed': v.s.showNewPassword }, children: v.newLabel }), _jsx(TextField, { label: "Confirm new password", type: v.confirmType, attrs: newPasswordAttrs, value: v.s.confirmPassword, onValueChange: v.confirmPassword, disabled: v.s.confirming }), _jsx(Button, { onPress: v.toggleConfirm, attrs: { 'aria-pressed': v.s.showConfirmPassword }, children: v.confirmLabel }), v.error ? _jsx(Notice, { tone: "danger", children: v.error }) : null] }) : null] }) });
+    const fieldId = useId();
+    return _jsx(ConfirmDialog, { ...v.confirm, body: _jsxs("div", { children: [_jsx("p", { children: v.s.pending?.user.username }), _jsx("p", { children: v.copy.body }), v.reset ? _jsxs(_Fragment, { children: [_jsx("label", { className: "jini-field-label", htmlFor: `${fieldId}-new`, children: "New password" }), _jsx(SecretInput, { id: `${fieldId}-new`, label: "New password", ...newPasswordAttrs, value: v.s.newPassword, onChange: event => v.newPassword({ value: event.target.value }), disabled: v.s.confirming, revealed: v.s.showNewPassword, onRevealedChange: v.toggleNew }), _jsx("label", { className: "jini-field-label", htmlFor: `${fieldId}-confirm`, children: "Confirm new password" }), _jsx(SecretInput, { id: `${fieldId}-confirm`, label: "Confirm new password", ...newPasswordAttrs, value: v.s.confirmPassword, onChange: event => v.confirmPassword({ value: event.target.value }), disabled: v.s.confirming, revealed: v.s.showConfirmPassword, onRevealedChange: v.toggleConfirm }), v.error ? _jsx(Notice, { tone: "danger", children: v.error }) : null] }) : null] }) });
 }
 //# sourceMappingURL=UsersConfirmation.js.map

package/dist/admin/react/hooks/UsersTab.hooks.d.ts

@@ -97,11 +97,7 @@ export declare function useUsersConfirmation(_required?: Record<string, never>,
     confirmPassword: ({ value }: {
         value: string;
     }) => void;
-    newType: "password" | "text";
-    confirmType: "password" | "text";
     toggleNew: () => void;
     toggleConfirm: () => void;
-    newLabel: string;
-    confirmLabel: string;
 };
 //# sourceMappingURL=UsersTab.hooks.d.ts.map

package/dist/admin/react/hooks/UsersTab.hooks.js

@@ -45,21 +45,15 @@ const confirmationCopy = {
     reset: { title: 'Reset password?', label: 'Reset password', tone: 'warning', body: 'Every active session for this user will be signed out.', consequence: 'revokes every active session' },
     disable: { title: 'Disable this user?', label: 'Disable', tone: 'warning', body: 'They will not be able to sign in until re-enabled.', consequence: 'revokes sign-in access' },
 };
-/** A password field's reveal state: its input type and its toggle button's label. */
-function revealState({ shown, name }, _optional = {}) {
-    return shown ? { type: 'text', label: `Hide ${name} password` } : { type: 'password', label: `Show ${name} password` };
-}
 export function useUsersConfirmation(_required = {}, _optional = {}) {
     const { state: s, controller: c } = useUsersView({});
     const kind = s.pending?.kind ?? 'disable', reset = kind === 'reset', mismatch = s.newPassword !== s.confirmPassword;
-    const copy = confirmationCopy[kind], shownNew = revealState({ shown: s.showNewPassword, name: 'new' }), shownConfirm = revealState({ shown: s.showConfirmPassword, name: 'confirm' });
+    const copy = confirmationCopy[kind];
     return { s, reset, mismatch, error: mismatch ? 'Passwords do not match.' : s.passwordError, copy,
         confirm: { open: s.pending !== null, title: copy.title, confirmLabel: copy.label, tone: copy.tone, consequence: copy.consequence, pending: s.confirming, agentMayConfirm: false,
             onConfirm: async () => { await c.confirmDestructive({}); }, onCancel: () => c.cancelDestructive({}) },
         newPassword: ({ value }) => c.setDraft({ patch: { newPassword: value } }),
         confirmPassword: ({ value }) => c.setDraft({ patch: { confirmPassword: value } }),
-        newType: shownNew.type, confirmType: shownConfirm.type,
-        toggleNew: () => c.togglePasswordVisible({ field: 'new' }), toggleConfirm: () => c.togglePasswordVisible({ field: 'confirm' }),
-        newLabel: shownNew.label, confirmLabel: shownConfirm.label, };
+        toggleNew: () => c.togglePasswordVisible({ field: 'new' }), toggleConfirm: () => c.togglePasswordVisible({ field: 'confirm' }), };
 }
 //# sourceMappingURL=UsersTab.hooks.js.map

package/dist/react/auth/Login.js

@@ -1,8 +1,11 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId } from "react";
+import { SecretInput } from "@jini-ai/ui";
 import { useLogin } from "./hooks/use-login.hooks.js";
 export function Login({ onLogin, port, translate, productName, initialUsername, useLoginHook = useLogin }) {
     const { username, setUsername, password, setPassword, error, busy, submit } = useLoginHook({ onLogin, port, translate }, { initialUsername });
     const t = translate;
-    return (_jsx("div", { className: "login-screen", children: _jsxs("form", { className: "login-card", onSubmit: submit, children: [_jsx("h1", { children: productName }), _jsx("p", { children: t("Sign in to your workspace") }), _jsxs("label", { children: [t("Username"), _jsx("input", { autoComplete: "username", value: username, onChange: (e) => setUsername(e.target.value), autoFocus: true })] }), _jsxs("label", { children: [t("Password"), _jsx("input", { type: "password", autoComplete: "current-password", value: password, onChange: (e) => setPassword(e.target.value) })] }), error ? _jsx("div", { className: "login-error", children: error }) : null, _jsx("button", { disabled: busy, children: busy ? t("Signing in…") : t("Sign in") })] }) }));
+    const passwordInputId = useId();
+    return (_jsx("div", { className: "login-screen", children: _jsxs("form", { className: "login-card", onSubmit: submit, children: [_jsx("h1", { children: productName }), _jsx("p", { children: t("Sign in to your workspace") }), _jsxs("label", { children: [t("Username"), _jsx("input", { autoComplete: "username", value: username, onChange: (e) => setUsername(e.target.value), autoFocus: true })] }), _jsxs("div", { children: [_jsx("label", { htmlFor: passwordInputId, children: t("Password") }), _jsx(SecretInput, { id: passwordInputId, label: t("Password"), toggleLabels: { show: t("Show password"), hide: t("Hide password") }, autoComplete: "current-password", value: password, onChange: (e) => setPassword(e.target.value) })] }), error ? _jsx("div", { className: "login-error", children: error }) : null, _jsx("button", { disabled: busy, children: busy ? t("Signing in…") : t("Sign in") })] }) }));
 }
 //# sourceMappingURL=Login.js.map

package/dist/react/users/Users.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import {} from "react";
+import { useId } from "react";
 import { RowMenu, ConfirmDialog } from "@jini-ai/admin/react";
 import { agentHandle } from "@jini-ai/agentic";
 import { buildAgentListHandles } from "@jini-ai/ui/panel-kit";
@@ -7,11 +7,13 @@ import { grantOptionLabel } from "./rules.js";
 import { UserGrantCells, UserNameCell, UserStatusCell, userRowMenuItemsFor } from "./UserRowParts.js";
 import { useUsers } from "./hooks/use-users.hooks.js";
 import { InfoTip } from "@jini-ai/ui/admin-widgets";
+import { SecretInput } from "@jini-ai/ui";
 import { useResetPasswordFields } from "./hooks/use-reset-password-fields.hooks.js";
 import { ChangeUsernameDialog } from "./ChangeUsernameDialog.js";
 /** The "New user" form — extracted from `Users` verbatim; own scope for `formError`/`saving`. */
 function NewUserForm({ username, setUsername, email, setEmail, password, setPassword, saving, formError, onCreate, t }) {
-    return (_jsxs("form", { onSubmit: onCreate, className: "notice integrations-form form-measure", children: [formError ? _jsx("span", { className: "save-error", children: formError }) : null, _jsxs("label", { children: [t("Username"), _jsx("input", { value: username, onChange: (e) => setUsername(e.target.value), required: true, ...agentHandle({ handle: "users-new-username" }, { role: "field", label: "The new user's username" }) })] }), _jsxs("label", { children: [t("Email (optional)"), _jsx("input", { type: "email", value: email, onChange: (e) => setEmail(e.target.value), ...agentHandle({ handle: "users-new-email" }, { role: "field", label: "The new user's email address" }) })] }), _jsxs("label", { children: [t("Password"), _jsx("input", { type: "password", autoComplete: "new-password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 1, ...agentHandle({ handle: "users-new-password" }, {
+    const passwordInputId = useId();
+    return (_jsxs("form", { onSubmit: onCreate, className: "notice integrations-form form-measure", children: [formError ? _jsx("span", { className: "save-error", children: formError }) : null, _jsxs("label", { children: [t("Username"), _jsx("input", { value: username, onChange: (e) => setUsername(e.target.value), required: true, ...agentHandle({ handle: "users-new-username" }, { role: "field", label: "The new user's username" }) })] }), _jsxs("label", { children: [t("Email (optional)"), _jsx("input", { type: "email", value: email, onChange: (e) => setEmail(e.target.value), ...agentHandle({ handle: "users-new-email" }, { role: "field", label: "The new user's email address" }) })] }), _jsxs("div", { children: [_jsx("label", { htmlFor: passwordInputId, children: t("Password") }), _jsx(SecretInput, { label: t("Password"), toggleLabels: { show: t("Show password"), hide: t("Hide password") }, id: passwordInputId, autoComplete: "new-password", value: password, onChange: (e) => setPassword(e.target.value), required: true, minLength: 1, ...agentHandle({ handle: "users-new-password" }, {
                             role: "field",
                             label: "The new user's password — a credential field, so only a human can fill it",
                         }) })] }), _jsx("button", { type: "submit", disabled: saving, ...agentHandle({ handle: "users-new-submit" }, { role: "button", label: "Create this operator account" }), children: saving ? t("Creating…") : t("Create user") })] }));
@@ -69,18 +71,6 @@ function UserDisableDialog({ confirmingDisable, setConfirmingDisable, toggleSavi
 function UserDeleteDialog({ confirmingDelete, setConfirmingDelete, deleteSaving, confirmDelete, t }) {
     return (_jsx(ConfirmDialog, { cancelLabel: t("Cancel"), open: confirmingDelete !== null, agentHandle: "users-delete", title: t("Delete this user?"), body: confirmingDelete ? (_jsxs("p", { children: [t("Delete"), " \"", confirmingDelete.username, "\"?", " ", t("They will be signed out and moved to the Trash. You can restore them there; they are deleted permanently after 60 days.")] })) : null, confirmLabel: t("Move to trash"), tone: "danger", pending: deleteSaving, onConfirm: confirmDelete, onCancel: () => setConfirmingDelete(null) }));
 }
-/** Open-eye glyph — standard "reveal" affordance, shown while a `RevealablePasswordField` is
- *  hidden (click to show). House stroke-icon convention (`viewBox="0 0 18 18"`, `fill="none"`,
- *  `stroke="currentColor"`, `strokeWidth={1.5}`, `aria-hidden`) — same shape `Media.tsx`'s
- *  `PlaceholderIcon`/`ExpandIcon`/`CloseIcon` and `nav.ts`'s panel icons use throughout this app. */
-function EyeIcon() {
-    return (_jsxs("svg", { viewBox: "0 0 18 18", fill: "none", stroke: "currentColor", strokeWidth: 1.5, "aria-hidden": "true", children: [_jsx("path", { d: "M1.5 9S4.5 4 9 4s7.5 5 7.5 5-3 5-7.5 5-7.5-5-7.5-5Z", strokeLinejoin: "round" }), _jsx("circle", { cx: "9", cy: "9", r: "2" })] }));
-}
-/** Same glyph with a slash through it — standard "hide" affordance, shown while the field is
- *  currently revealed (click to hide). */
-function EyeOffIcon() {
-    return (_jsxs("svg", { viewBox: "0 0 18 18", fill: "none", stroke: "currentColor", strokeWidth: 1.5, "aria-hidden": "true", children: [_jsx("path", { d: "M1.5 9S4.5 4 9 4s7.5 5 7.5 5-3 5-7.5 5-7.5-5-7.5-5Z", strokeLinejoin: "round" }), _jsx("circle", { cx: "9", cy: "9", r: "2" }), _jsx("path", { d: "M3 3 15 15", strokeLinecap: "round" })] }));
-}
 /** One password input plus its own independent show/hide toggle. `UserResetPasswordDialog` renders
  *  this twice (new password, confirm new password) so each field can be revealed on its own — the
  *  whole point of the confirm field is catching a typo by eye, which a single toggle driving both
@@ -89,22 +79,21 @@ function EyeOffIcon() {
  *  twice.
  *
  *  The toggle itself is icon-only (standard eye / eye-with-slash convention, per owner request —
- *  not a text "Show"/"Hide" link): the accessible name still flips between "Show password"/"Hide
- *  password" via `aria-label` (screen reader), and `aria-pressed` mirrors `visible` so assistive
- *  tech gets the same on/off signal a text label would have given.
+ *  not a text "Show"/"Hide" link): the accessible name flips between "Show <label>"/"Hide <label>"
+ *  via `aria-label` (screen reader), which is the one on/off signal a text label would have given
+ *  (no `aria-pressed` on top: that announced the state twice). The shared stroke icon keeps the
+ *  open-eye/eye-with-slash convention without duplicating glyphs in this screen.
  *
- *  The input's inline `flex`/`minWidth` override neutralizes `styles.css`'s `.field input { width:
- *  100% }` fighting the toggle button for room inside the `.editor-actions` row below — an inline
- *  style wins on specificity without adding a new class to a stylesheet this feature doesn't own. */
+ *  The shared `.jini-secret` wrapper gives the icon its own space: the host's `.field input {
+ *  width: 100% }` must not make the input fight a sibling toggle for room. */
 function RevealablePasswordField({ id, label, value, onChange, visible, onToggleVisible, agentBase, t }) {
-    const toggleLabel = visible ? t("Hide password") : t("Show password");
-    return (_jsxs("div", { className: "field", children: [_jsx("label", { className: "field-label", htmlFor: id, children: label }), _jsxs("span", { className: "editor-actions", children: [_jsx("input", { id: id, type: visible ? "text" : "password", 
-                        // `new-password`, not `off` (Chrome ignores `off`): without it Chrome filled a saved
-                        // login into "New password" only. Kept while revealed as `type="text"`, too.
-                        autoComplete: "new-password", value: value, onChange: (e) => onChange(e.target.value), style: { flex: "1 1 auto", minWidth: 0 }, ...agentHandle({ handle: agentBase }, {
-                            role: "field",
-                            label: `${label} — a credential field, so only a human can fill it`,
-                        }) }), _jsx("button", { type: "button", className: "link-button", "aria-label": toggleLabel, "aria-pressed": visible, title: toggleLabel, onClick: onToggleVisible, ...agentHandle({ handle: `${agentBase}-reveal` }, { role: "button", label: `Show or hide the ${label.toLowerCase()} field's characters` }), children: _jsx("span", { style: { display: "inline-flex", width: 16, height: 16 }, children: visible ? _jsx(EyeOffIcon, {}) : _jsx(EyeIcon, {}) }) })] })] }));
+    return (_jsxs("div", { className: "field", children: [_jsx("label", { className: "field-label", htmlFor: id, children: label }), _jsx(SecretInput, { id: id, label: label, toggleLabels: { show: `${t("Show")} ${label}`, hide: `${t("Hide")} ${label}` }, revealed: visible, onRevealedChange: onToggleVisible, toggleAttrs: agentHandle({ handle: `${agentBase}-reveal` }, { role: "button", label: `Show or hide the ${label.toLowerCase()} field's characters` }), 
+                // `new-password`, not `off` (Chrome ignores `off`): without it Chrome filled a saved
+                // login into "New password" only. Kept while revealed as `type="text"`, too.
+                autoComplete: "new-password", value: value, onChange: (e) => onChange(e.target.value), style: { flex: "1 1 auto", minWidth: 0 }, ...agentHandle({ handle: agentBase }, {
+                    role: "field",
+                    label: `${label} — a credential field, so only a human can fill it`,
+                }) })] }));
 }
 /** Resolves `useFields` to the real hook when no override is passed, because ESLint's
  *  cyclomatic-complexity rule counts a default parameter value evaluated inside a function's OWN

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/user-management",
-  "version": "0.6.11",
+  "version": "0.6.15-rc.1",
   "description": "Runtime-separated user management contracts and Node authentication, authorization, and administration services.",
   "license": "Apache-2.0",
   "repository": {
@@ -87,16 +87,16 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.6.11"
+    "@jini-ai/core": "^0.6.15-rc.1"
   },
   "peerDependencies": {
     "argon2": "^0.44.0",
     "react": "^18.3.0 || ^19.0.0",
     "react-dom": "^18.3.0 || ^19.0.0",
-    "@jini-ai/ui": "^0.6.10",
-    "@jini-ai/admin": "^0.6.10",
-    "@jini-ai/agentic": "^0.6.10",
-    "@jini-ai/ui-kit": "^0.6.10"
+    "@jini-ai/ui": "^0.6.15-rc.1",
+    "@jini-ai/admin": "^0.6.15-rc.1",
+    "@jini-ai/agentic": "^0.6.15-rc.1",
+    "@jini-ai/ui-kit": "^0.6.15-rc.1"
   },
   "peerDependenciesMeta": {
     "argon2": {
@@ -134,12 +134,12 @@
     "@testing-library/user-event": "^14.5.0",
     "@testing-library/jest-dom": "^6.6.3",
     "jsdom": "^25.0.1",
-    "@jini-ai/ui": "0.6.11",
-    "@jini-ai/cms": "0.6.11",
-    "@jini-ai/core": "^0.6.11",
-    "@jini-ai/admin": "0.6.11",
-    "@jini-ai/agentic": "0.6.11",
-    "@jini-ai/ui-kit": "^0.6.11"
+    "@jini-ai/ui": "0.6.15-rc.1",
+    "@jini-ai/agentic": "0.6.15-rc.1",
+    "@jini-ai/cms": "0.6.15-rc.1",
+    "@jini-ai/core": "^0.6.15-rc.1",
+    "@jini-ai/admin": "0.6.15-rc.1",
+    "@jini-ai/ui-kit": "^0.6.15-rc.1"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",